-
Notifications
You must be signed in to change notification settings - Fork 19
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Volume device type #276
Volume device type #276
Conversation
custom_schemas/custom_dll.yml
Outdated
- name: Ext.device.volume_device_type | ||
level: custom | ||
type: keyword | ||
short: FILL ME IN |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@Trinity2019 can you update these FILL ME INs
Thanks @ferullo for updating endpoint-package! |
Co-authored-by: Yamin Tian <56367679+Trinity2019@users.noreply.github.com>
Thanks for the doc updates @Trinity2019 . For future reference, I should have mentioned that only the files in |
@elastic/security-onboarding-and-lifecycle-mgt can this be merged or is there a merge-freeze right now? |
@ferullo we have just cut the Endpoint package over for Ideally, we start to enforce merge-freezes a couple days before stack FF so that we have time to release the package and ensure there aren't any testing issues. @pzl can correct me if I'm wrong, we can release another package for |
These fields will be generated by Endpoint in 8.4 but it won't cause any problems if we don't merge this. Waiting for the next package release is ok. |
When this gets in, we can backport for an |
Yes, this and #280 will be For this PR, can we update the test files with values for this field? Looks like that should be:
Once we have values in the test files, this is good to merge |
@Trinity2019 This PR doesn't have |
I believe the CI failure is just the newlines at the end of the sample_event.json files. |
Ah thanks, fixed. I did not make the change you suggested for |
@pzl are you ok with this being merged? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
looks good. ok to merge. I will issue a followup PR that will remove
threat.enrichments.indicator.file.Ext.device.volume_device_type
threat.indicator.file.Ext.device.volume_device_type
from the alerts index before we ship anywhere
OK, thanks @pzl! |
Change Summary
This adds
volume_device_type
.Sample values
Sample document:
None
Release Target
Ideally for 8.4
Q/A
N/A
For mapping changes:
make
after making the schema changes, and committed all changesmetadata
change, I also updated both transform destination schemas to matchFor Transform changes: